Submit #1021294: TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection

setUploadSetting restores a saved configuration file. It is implemented in lib/cste_modules/upgrade.so and dispatched by bin/cste_sub from the topic totolink/router/upgrade/setUploadSetting. The handler reads the file name with websGetVar(a2, "FileName", "") and immediately builds sprintf(s_1, "cat %s | grep %s", Var, v30), where v30 is the device model string obtained from apmib_get(7102, v30). That string is then passed to getCmdStr(s_1, v33, 16), which executes it through a shell and captures the first bytes of the output. The call is the first statement of the handler and it happens before any size check, before any marker check and before any checksum check, so nothing constrains the value of FileName. Any shell metacharacter in the parameter is interpreted by /bin/sh running as root: a semicolon terminates the cat command and starts an attacker-chosen one, a pipe redirects the stream, and a backtick performs command substitution. The handler also uses the same parameter as a path for fopen(Var, "r"), so it is simultaneously an arbitrary file read: the file is read into a heap buffer and fed to find_head_offset, and although its content is not returned verbatim, the response distinguishes a readable file from an unreadable one and the file is then decoded as a configuration image, which makes the primitive usable for reading any file the root user can open. Because the injection happens at 0x40F8, which is the very first operation on the parameter, a single request yields command execution regardless of the state of the rest of the handler.

• Quelle: ⚠️ https://gist.github.com/H3rmesk1t/9734a830a36bf6fb9229db11b410e70c
• Benutzer: H3rmesk1t (UID 70306)
• Einreichung: 09.10.2026 08:19 (vor 14 Tagen)
• Moderieren: 21.10.2026 20:16 (12 days later)
• Status: Duplikat
• VulDB Eintrag: 195148 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R setUploadSetting FileName erweiterte Rechte]
• Punkte: 0